hi everyone and thank you for looking at my posting.
i have an inquire that hopefully someone will be able to help me with, as i am all out of ideas
how would i get the system time setting from a computer if the computers its self was sealed.
i thought that i would be able to boot up the system and then go directly into the bios and get the setting from the bios before the system started to do it's checks but then i thought that if i missed the time span allowed to enter the bios then effectively i would be tampering with evidence, i cant put a write blocker on to the disk as the units self is sealed and i cant get to the hard disk.
i had another idea to break the seal with a compentent person present and get the system time that way form the from the RTC.
any help on this matter would be really appreciated.
thanks again
christop007
Not sure if this is true of all systems but won't and Intel system halt during POST if there is no keyboard detected? If so unplug the keyboard.
What about a boot DOS floppy disk in the drive ?
Usually the floppy drive is the first media to boot in the Bios
And a CD rom with Helix or a linux live cd in the cdrom drive
But the most difficult is to be be sure that it is not the hard drive that starts
in first and to be the fastest to press the bios key roll
Psy
thanks for the response to the intitial question
i am not sure about booting from a floopy can anyone advise if this would be classed as tampering with evidence, or if i get to into the bios and check the system time and turn the computer off woulld this be classed as tampering with evidence, its more about the continuity of evidence that i am concern with
i will also do more research about unplugging the key board but i need to be sure before i attempt this as if i boot i dont even have the option to go into bios.
thanks again
christop007
Are you able to examine the computer visually for any clues (i.e. make, model, serial no. etc) which might allow you to research the correct procedure for entering the BIOS during boot up, prior to attempting to do so?
Jamie
hi jamie
i am a not sure if i am allowed to enter the bios at all as i think this would be tampering with evidence can anyone advise
christop007
It depends on the case, of course, and you should seek appropriate professional advice from someone well versed in the case as to the best course of action for you to take. That said, if the case does call for you to enter the BIOS, you attempt to do so in a sensible fashion and document your actions responsibly then it may well be an appropriate course of action to take.
Jamie
There are other ways to verify system time. Most involve embedded dates and times within html pages in the internet cache. Hotmail messages for instance have embedded server dates within them. Search the text of that message for "ct=". It's followed by a 10 digit unix date. Looks like this "ct=1137596620". By comparing that with the file's created time you can judge the accuracy of the system clock.
There are a lot of ways to do it. Limited only by your imagination really. If you see weather radar pictures they will have a date and time right on the image. It wont be exact, but most of those pictures are updated every 3 or 6 hours.
hi guys
thanks for the advice i have a little bit more research to do on different area and i will let you know how i get on
thanks again its most appreciated
christop007